SecuriteInfo[.]com[.]Win32[.]Evo-gen[.]12588[.]8591[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

SecuriteInfo.com.Win32.Evo-gen.12588.8591.exe
Size

5.0MB
MD5

a80501b57401af6f8d1fb472aebc4412
SHA1

a370e36f6a527af1f6f575cedbee5ea91db29bbe
SHA256

ff20886938ec03ced01b7b7340ac16a3431897d2f03588a3117ec6ad255e1c8a
SHA512

0f91adcd9c5f1fc1525bab44ba38b9e54caf91526c458296354118418a9cc5693f6afc5f6874c34b9ac4f9f66ba6a275a7fd12ff00085465234c615d049f80c6
SSDEEP

98304:uF29lJ7UzPljfRCnwFAPNQM+QoZIBtfVPAXOx91R1PskZgzdhu:EiD4TldCw++3idBLnPHZgzfu

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Files

SecuriteInfo.com.Win32.Evo-gen.12588.8591.exe
.exe windows:5 windows x86 arch:x86

Code Sign

6d:5f:4e:88:1a:bc:c0:4e:b7:f0:2a:32:b8:e6:52:5c
Certificate

Issuer

CN=Home

Not Before

31/12/2023, 17:00

Not After

31/12/2024, 17:00

Subject

CN=Home

Extended Key Usages

ExtKeyUsageCodeSigning

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

10/12/2014, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:07:64:9b:08:b0:a7:fe:7d:d6:54:a8:f2:f4:29:f6
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

07/11/2023, 17:13

Not After

09/12/2034, 17:13

Subject

CN=Globalsign TSA for MS Authenticode Advanced - G4 - 202311,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

da:e1:b6:07:74:7b:46:38:9c:b9:3f:4a:70:d3:38:4d:36:36:bd:f8
Signer

Actual PE Digest

da:e1:b6:07:74:7b:46:38:9c:b9:3f:4a:70:d3:38:4d:36:36:bd:f8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

Size: 339KB - Virtual size: 618KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 62KB - Virtual size: 190KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 732B - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 561KB - Virtual size: 561KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 24KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.imports
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 5.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 4.0MB - Virtual size: 4.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 16B - Virtual size: 4KB

IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

6d:5f:4e:88:1a:bc:c0:4e:b7:f0:2a:32:b8:e6:52:5cCertificate

Extended Key Usages

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51Certificate

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

01:07:64:9b:08:b0:a7:fe:7d:d6:54:a8:f2:f4:29:f6Certificate

Extended Key Usages

Key Usages

da:e1:b6:07:74:7b:46:38:9c:b9:3f:4a:70:d3:38:4d:36:36:bd:f8Signer

Headers

DLL Characteristics

File Characteristics

Sections

Size: 339KB - Virtual size: 618KB

Size: 62KB - Virtual size: 190KB

Size: 732B - Virtual size: 28KB

Size: 561KB - Virtual size: 561KB

Size: 24KB - Virtual size: 29KB

.imports Size: 1KB - Virtual size: 4KB

.tls Size: 512B - Virtual size: 4KB

.rsrc Size: 9KB - Virtual size: 9KB

.themida Size: - Virtual size: 5.7MB

.boot Size: 4.0MB - Virtual size: 4.0MB

.reloc Size: 16B - Virtual size: 4KB

6d:5f:4e:88:1a:bc:c0:4e:b7:f0:2a:32:b8:e6:52:5c
Certificate

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

01:07:64:9b:08:b0:a7:fe:7d:d6:54:a8:f2:f4:29:f6
Certificate

da:e1:b6:07:74:7b:46:38:9c:b9:3f:4a:70:d3:38:4d:36:36:bd:f8
Signer

.imports
Size: 1KB - Virtual size: 4KB

.tls
Size: 512B - Virtual size: 4KB

.rsrc
Size: 9KB - Virtual size: 9KB

.themida
Size: - Virtual size: 5.7MB

.boot
Size: 4.0MB - Virtual size: 4.0MB

.reloc
Size: 16B - Virtual size: 4KB